REST without an SDK
Using an SDK is not mandatory. From a language without an official SDK (Go, .NET, Ruby …), or for an endpoint an SDK does not cover, you can call the REST API directly. The only difference is that you handle signing and token management yourself.
Flow
The flow has two steps. First you obtain a token with a request signed by your Ed25519 private key:
curl -X POST https://api-gateway.lunixi.com/api/v1/auth/token \
-H "X-Key-Id: $LUNIXI_KEY_ID" \
-H "X-Date: $DATE" \
-H "X-Nonce: $NONCE" \
-H "X-Signature: $SIGNATURE"Then you call endpoints with the returned access_token:
curl -X POST https://api-gateway.lunixi.com/api/v1/fraud/decisions/evaluate \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "transactionRef": "order-2026-0001", "subjectId": "order-2026-0001" }'Your API key does not go into the Authorization header directly. The key only produces the signature that obtains a token; the value you send to endpoints is the access_token returned by that call. → Authentication
A token lives for 5 minutes. Rather than minting a new one on every call, cache it and renew based on expires_at — the SDKs do this for you.
Related
- Authentication — canonical string, signature headers and token lifetime
- Postman — a ready collection that signs for you
- Error Handling — response envelope and error codes